4 ms·

Capital One provides this toy API: http://api.reimaginebanking.com http://api.reimaginebanking.com If you want to create an app or startup that does anything i

Capital One provides this toy API: http://api.reimaginebanking.com http://api.reimaginebanking.com If you want to create an app or startup that does anything involving banking, look elsewhere. The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on hand in the high 7 figures. Here's a good example of what I'm talking about: https://medium.com/@oscargodson/thatll-do-pig-that-ll-do-8998f9df9f77 https://medium.com/@oscargodson/thatll-do-pig-that-ll-do-899...

Cshelton 10y ago
Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with... All good intentions have consequences.
- djsumdog 10y ago
  Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.
  - Cshelton 10y ago
    To my knowledge, that is what Mint is doing. I'm curious how they handle two factor authentication?
    - alistproducer2 10y ago
      In Project Posada, my open source Mint alternative project, we handle it with an app on the user's phone that receives texts and, using regex, grabs the code of relevant sms messages then pushes the code back to the scraper, which then inputs the code and continues on.
  - overcast 10y ago
    David K Michaels, VP Engineering, Mint.com 27.2k Views For passwords to Mint itself, we compute a secure hash of the user's chosen password and store only the hash (the hash is also salted - see http://en.wikipedia.org/wiki/Sal.. http://en.wikipedia.org/wiki/Sal... ). Hashing is a one-way function and cannot be reversed. It is not possible to ever see or recover the password itself. When the user tries to login, we compute the hash of the password they are attempting to use and compare it to the hashed value on record. (This is a standard technique which every site should use). For banking credentials, we generally must use reversible encryption for which we have special procedures and secure hardware kept in our secure and guarded datacenter. The decryption keys never leave the hardware device (which is built to destroy the key material if the tamper protection is attacked). This device will only decrypt after it is activated by a quorum of other keys, each of which is stored on a smartcard and also encrypted by a password known to only one person. Furthermore the device requires a time-limited cryptographically-signed permission token for each decryption. The system (which I designed and patented) also has facilities for secure remote auditing of each decryption. https://www.quora.com/How-do-mint-com-and-similar-websites-avoid-storing-passwords-in-plain-text/answer/David-K-Michaels?share=1 https://www.quora.com/How-do-mint-com-and-similar-websites-a...
    - alistproducer2 10y ago
      If anyone is curious exactly how the system he describes works, here's a list of Mint's patent's. http://www.justanswer.com/intellectual-property-law/8u21f-patents-awarded-mint-com-la.html http://www.justanswer.com/intellectual-property-law/8u21f-pa...
- fab123 10y ago
  Check out https://geltbox.com https://geltbox.com With it you can basically create financial scrapers by just browsing the web. No API in the meantime but works just fine.
KirinDave 10y ago
> The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on hand in the high 7 figures. Full disclosure, I work for Capital One now. So... C1 has stated publicly it's interested in this space and some of its prominent employees are in prominent public technical groups trying to make it happen. The liability and fraud stories are really unimaginably complicated. For people looking to make a product today, I've decided to add a quick primer: Finicity, FinancialServices, and Plaid are all financial aggregators that you can use in combination with novel (read: quasi-legal) mechanisms you can use to provide financial services within the confines of the beleaguered law. In general a financial product's engineering cycle looks like this: 1. Find a data aggregator you can partner with and give most of your profits to. 2. Work very hard on experience driven products. 3. Find a good lawyer who can help you produce a novel interpretation of the law that works with a specific financial product. 4. Still have limited success because fintech products have linear adoption curves (even Mint). Examples in this space of novel mechanisms that use existing payment services, data aggregation products and very clever lawyers: Acorns, Digit, Tally. I was one of the founders and the founding engineer of Level, and worked on Simple. My general observation is that most of the challenge is around data quality and aggregation on the technical side of things. A lot of the challenge of making these apps work is balancing your fraud risk with your customer experience. Customers are apathetic and inclined to ignore the space, fraudsters are diabolically clever and very engaged.
- mildbow 10y ago
  heartily agree with "give most of your profits to" Even though Plaid comes up a lot in these conversation, I haven't found their pricing any better or startup friendly than any other provider (fincity, yodlee etc). Better marketing yes. Better api? Meh. Anyway, I see the current set of financial data aggregators being fine for market validation for some type of applications, but they are too expensive to allow for wide-spread innovation.
  - KirinDave 10y ago
    Plaid has callback support and good latency. While I appreciate and have worked with Intuit for a long time, it's difficult not to say plaid has the edge in a modern API design. The current aggregators are optimized for big businesses and venture backed startups. I used them to sell a startup to capital one, and I named other people doing the same. You just need to think very long and very hard about your business model.

Cshelton 10y ago

Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with... All good intentions have consequences.

djsumdog 10y ago
Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.
- Cshelton 10y ago
  To my knowledge, that is what Mint is doing. I'm curious how they handle two factor authentication?
  - alistproducer2 10y ago
    In Project Posada, my open source Mint alternative project, we handle it with an app on the user's phone that receives texts and, using regex, grabs the code of relevant sms messages then pushes the code back to the scraper, which then inputs the code and continues on.
- overcast 10y ago
  David K Michaels, VP Engineering, Mint.com 27.2k Views For passwords to Mint itself, we compute a secure hash of the user's chosen password and store only the hash (the hash is also salted - see http://en.wikipedia.org/wiki/Sal.. http://en.wikipedia.org/wiki/Sal... ). Hashing is a one-way function and cannot be reversed. It is not possible to ever see or recover the password itself. When the user tries to login, we compute the hash of the password they are attempting to use and compare it to the hashed value on record. (This is a standard technique which every site should use). For banking credentials, we generally must use reversible encryption for which we have special procedures and secure hardware kept in our secure and guarded datacenter. The decryption keys never leave the hardware device (which is built to destroy the key material if the tamper protection is attacked). This device will only decrypt after it is activated by a quorum of other keys, each of which is stored on a smartcard and also encrypted by a password known to only one person. Furthermore the device requires a time-limited cryptographically-signed permission token for each decryption. The system (which I designed and patented) also has facilities for secure remote auditing of each decryption. https://www.quora.com/How-do-mint-com-and-similar-websites-avoid-storing-passwords-in-plain-text/answer/David-K-Michaels?share=1 https://www.quora.com/How-do-mint-com-and-similar-websites-a...
  - alistproducer2 10y ago
    If anyone is curious exactly how the system he describes works, here's a list of Mint's patent's. http://www.justanswer.com/intellectual-property-law/8u21f-patents-awarded-mint-com-la.html http://www.justanswer.com/intellectual-property-law/8u21f-pa...
fab123 10y ago
Check out https://geltbox.com https://geltbox.com With it you can basically create financial scrapers by just browsing the web. No API in the meantime but works just fine.

KirinDave 10y ago

> The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on hand in the high 7 figures. Full disclosure, I work for Capital One now. So... C1 has stated publicly it's interested in this space and some of its prominent employees are in prominent public technical groups trying to make it happen. The liability and fraud stories are really unimaginably complicated. For people looking to make a product today, I've decided to add a quick primer: Finicity, FinancialServices, and Plaid are all financial aggregators that you can use in combination with novel (read: quasi-legal) mechanisms you can use to provide financial services within the confines of the beleaguered law. In general a financial product's engineering cycle looks like this: 1. Find a data aggregator you can partner with and give most of your profits to. 2. Work very hard on experience driven products. 3. Find a good lawyer who can help you produce a novel interpretation of the law that works with a specific financial product. 4. Still have limited success because fintech products have linear adoption curves (even Mint). Examples in this space of novel mechanisms that use existing payment services, data aggregation products and very clever lawyers: Acorns, Digit, Tally. I was one of the founders and the founding engineer of Level, and worked on Simple. My general observation is that most of the challenge is around data quality and aggregation on the technical side of things. A lot of the challenge of making these apps work is balancing your fraud risk with your customer experience. Customers are apathetic and inclined to ignore the space, fraudsters are diabolically clever and very engaged.

mildbow 10y ago
heartily agree with "give most of your profits to" Even though Plaid comes up a lot in these conversation, I haven't found their pricing any better or startup friendly than any other provider (fincity, yodlee etc). Better marketing yes. Better api? Meh. Anyway, I see the current set of financial data aggregators being fine for market validation for some type of applications, but they are too expensive to allow for wide-spread innovation.
- KirinDave 10y ago
  Plaid has callback support and good latency. While I appreciate and have worked with Intuit for a long time, it's difficult not to say plaid has the edge in a modern API design. The current aggregators are optimized for big businesses and venture backed startups. I used them to sell a startup to capital one, and I named other people doing the same. You just need to think very long and very hard about your business model.